fix: prevent stale WAP audit approval with candidate-bound checks

fix: prevent stale WAP audit approval with candidate-bound checksphlohouse/phlo #1202 · 2 diagrams

100%

01 / 05Candidate check binding added to WAP configBranch WAP runs can now require checks bound to candidate branch hashes. validates require_candidate_bound_checks in +11 −0 and passes it to .
02 / 05Adapter now binds check execution to branch hashThe check runner captures the branch hash and verifies it did not change. calls and against in +28 −0.
03 / 05Check results now include candidate metadataDagster check events record the audited branch ref and hash. returns candidate metadata in +10 −3.
04 / 05Sensor now validates candidate checksPromotion halts if check binding is missing or the hash changed. checks candidate metadata before in +26 −0.
05 / 05Everything this change touchedThe WAP configuration, check execution adapter, and promotion sensor.

esc to leave

StarHelp other teams find it